EP3195123B1

EP3195123B1 - Dynamic application containers

Info

Publication number: EP3195123B1
Application number: EP15775846.7A
Authority: EP
Inventors: Jeremy Christopher DORFMAN; Jeremy Edward DUNKER
Original assignee: Microsoft Technology Licensing LLC
Current assignee: Microsoft Technology Licensing LLC
Priority date: 2014-09-19
Filing date: 2015-09-17
Publication date: 2020-11-25
Anticipated expiration: 2035-09-17
Also published as: EP3195123A1; US9824136B2; US20160085841A1; CN106687928A; WO2016044504A1; CN106687928B

Description

Background and Relevant Art

Handheld mobile computing devices have become ubiquitous. For example, many people have so-called smart phones or tablet computers. Such devices allow users to use cellular data systems or other network systems to access a broad spectrum of services. For example, using such devices, a user can access email, the Internet, on-line databases, etc. People who have personal smart phones (or other smart devices) may often want to use these personal devices to access company resources belonging to the companies by which they are employed.
Identifying and dealing with different classifications of data (e.g. personal versus corporate) on mobile devices can be difficult, particularly when the device is used in different user settings (e.g. business vs. personal use).
The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrate one exemplary technology area where some embodiments described herein may be practiced.
Patent application document US2011161988 discloses an operating system having a kernel level and a user level, with the kernel level configured with a first container and a second container. The first container is assigned to a first namespace and the secomd container is assigned to a second namespace. Both the first and second namespaces are isolated from each other and at the same time in communication with at least one shared object. Communication across the containers is created through a socket in the namespace of the shared object of one or both containers

BRIEF SUMMARY

One embodiment illustrated herein includes a method that may be practiced in a computing environment. The method includes acts for managing application interaction on a device using dynamic containers. The method includes, for a set of applications on a device, based on certain conditions, determining a plurality of container groups. Each container group defines a set of applications and a set of interactions parameters defining boundaries of interactions between the applications for the applications in the container group. The method further includes identifying one or more changes in the certain conditions. As a result of identifying one or more changes in the certain conditions, the method includes changing membership in the container groups.
Another embodiment includes a device configured to manage application interaction. The device includes a plurality of applications. The device further includes a plurality of application containers. A given application container groups applications together and enforces boundaries of interaction between the applications in the given container. The device is configured to change a set of applications in a container based on changes in conditions.
This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Additional features and advantages will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the teachings herein. Features and advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. Features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth hereinafter.
The invention is defined by the independent claims. Dependent claims disclose additional embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and other advantages and features can be obtained, a more particular description of the subject matter briefly described above will be rendered by reference to specific embodiments which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments and are not therefore to be considered limiting in scope, embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:

Figure 1 illustrates a device having applications dynamically organized into containers; and
Figure 2 illustrates a method of managing application interaction on a device using dynamic containers.

DETAILED DESCRIPTION

A containerization solution can be used to isolate different classifications of data from one another. Containerization is the process of segregating data on a device such that data that meets a certain set of qualifiers ends up in a particular set of containers. The goal of containerization is to apply a certain set of traits to a particular container, e.g. encryption or access restriction. In some embodiments, a container can enforce boundaries of interaction between applications in the container. Some embodiments herein implement a set of mechanisms for dynamically building one or more containers for applications based on one or more attributes. For example, attributes may include one or more of: sources of applications, policy constraints, factors related to installation of an application, network connections, geo fencing considerations, time fencing considerations, etc. The ability to dynamically produce containers gives greater flexibility in determining how information is shared amongst applications.
Referring now to Figure 1, an example embodiment is illustrated. Figure 1 illustrates a device 102. The device may be, for example, a mobile device such as a phone, tablet or other mobile device. However, the device 102 may be a specimen selected from classes of other less mobile or immobile computing devices. The device 104 has installed thereon a set of applications 104.
Embodiments can leverage multiple pieces of information to determine the containers in which an application can participate. Figure 1 illustrates a set of such containers 118. In the example illustrated in Figure 1, a device management agent 108, a centralized piece of software running on the device, is leveraged to retrieve application specific policy 116 from a service 112 and to enforce the application specific policy 116 to cause applications to be included in or excluded from certain containers. In some embodiments, the device management agent 108 may be implemented using Company Portal available from Microsoft Corporation of Redmond Washington.
The device management agent may also monitor software installation on the device 102. In some embodiments, access to a given container is gated by the device management agent 108 on policy, however, the policy is targeted at specific applications that may originate from the management service 112, (such as an Intune service available from Microsoft Corporation of Redmond, Washington) or the platform provided store (such as iTunes for iOS platform devices, Play Store for Android devices, Windows Store for Windows devices, etc.) When an application that is restriction enabled starts, it contacts the management service 112 (such as in the example illustrated through the device management agent 108) to retrieve its policy and container specific configuration. This call to the management service 112 also enables applications that were on the device 102 prior to a given container enablement to participate in a new container.
Embodiments can also monitor the installation of new applications on the device 102 to determine if they should be granted access to a container. This allows applications that are added to the device 102 after an original container is defined to participate in the container if policy allows.
Various additions or alternative may be implemented in various embodiments. For example, some embodiments may implement policy independent identification of applications for containers. For example, a container may be determined based on the publisher of an application, the application type, or other application characteristics.
In some embodiments, a single application may be able to participate in multiple containers simultaneously.
In some embodiments, alternate sources of information for container accessibility may be implemented. For example embodiments may be able to restrict access to containers based on device location. This may be determined by GPS, cellular location, Wi-Fi location services, etc. Embodiments may be able to restrict access based on network connection considerations. For example, contain accessibility may be restricted for certain application where restrictions require a known network, connection to a VPN, certain network encryption, etc.
In some embodiments multiple sources of information may be used to identify applications that can access a container.
Some embodiments may identify applications that should be included or excluded from a container based on defined policy.
As noted previously, some embodiments, can allow applications which were on a device prior to a container solution being implemented to participate in the containers.
Embodiments may identify applications which should be included\excluded from the container based on installation source. Thus, for example, some applications may be excluded from certain containers if they are installed from the platform application repository where applications installed from a management service through a device management agent may be allowed for those same containers.
Embodiments may be able to remove previously included applications from a container when criteria change. As noted, this may be enabled by checks made by applications when they start to contact a management service to obtain policy and container specific configuration.
Embodiment may identify applications which should be included or excluded from the container based on device compliance. For example, factors such as operating systems, operating system versions, the device being password or pin protected, password protection being of a certain level (such as length and/or complexity), etc.
As noted previously, embodiments may allow applications to participate in multiple distinct containers.
The following discussion now refers to a number of methods and method acts that may be performed. Although the method acts may be discussed in a certain order or illustrated in a flow chart as occurring in a particular order, no particular ordering is required unless specifically stated, or required because an act is dependent on another act being completed prior to the act being performed.
Referring now to Figure 2, a method 200 is illustrated. The method 200 includes acts that may be practiced in a computing environment. The method 200 includes acts for managing application interaction on a device. The method 200 includes, for a set of applications on a device, based on certain conditions, determining a plurality of container groups (act 202). Each container group defines a set of applications and a set of interaction parameters defining boundaries of interaction between the applications for the applications in a given container group. Thus, for example, as illustrated in Figure 1, applications 104 may be organized into different containers 118. Applications within a given container are allowed to interact with each other in certain ways as defined by the parameters for a given container. Interaction details will be discussed in more detail below.
The method 200 further includes identifying one or more changes in the certain conditions (act 204). Examples of various changes are illustrated below.
The method 200 further includes, as a result of identifying one or more changes in the certain conditions, changing membership in the container groups (act 206). Thus, applications can be dynamically placed in different containers.
Various interaction boundaries may be enforced for applications in the same container. For example, the method 200 may be practiced where the boundaries of interactions between the applications comprise allowing sharing encryption for a dataset. Thus for example, different applications can use a same encrypted dataset. The applications may share encryption and decryption keys when they are in the same container.
Alternatively or additionally, the boundaries of interactions between the applications may include restricting access to certain data.
Alternatively or additionally, the boundaries of interactions between the applications may include restricting certain interactions. For example, cut/copy/paste functionality may be restricted between applications in the same container and/or from those applications to other applications. Other boundaries may include boundaries on starting another application, checking for the existence of another application, reading documents or data from another application, sending data to another application, being started by another application, etc.
The method of claim may be practiced where the certain conditions comprise factors related to installation source for an application. For example, container selection for an application may be different when the application is installed from a general application store than when installed from an organization specific repository of applications.
The method 200 may be practiced where the change in certain conditions includes factors related to installation of an application. For example, a new application being installed may affect container decisions for other applications. This may be due to the installed application itself being included in one or more containers, restrictions of existing applications with respect to the installed application, or for other reasons. Similarly, the method 200 may be practiced where the change in certain conditions includes factors related to removal of an application. Similarly, the method 200 may be practiced where the change in certain conditions includes factors related to an application update.
The method 200 may be practiced where the change in certain conditions includes factors related to change in policy. Policy changes may affect how applications are assigned to containers.
The method 200 may be practiced where the change in certain conditions includes factors related to an application action.
The method 200 may be practiced where the change in certain conditions includes factors related to identity switching. Thus, for example, if a user switches accounts or otherwise switches their identity on a device, this may cause a change in how applications are assigned to containers.
The method 200 may be practiced where the change in certain conditions includes factors related to geo-fencing. Thus, for example, the physical location of the device may be determined (such as through GPS, cellular tower tracking, Wi-Fi location services, etc.) and the physical location may be used to determine how applications are assigned to containers. Similarly, the method 200 may be practiced where the change in certain conditions includes factors related to time fencing. Container assignments may be changed based on time. Thus, for example, at certain times of the day, administrators may wish to restrict or permit application functionality. For example, an administrator may wish to allow access to certain data during working hours, but restrict the access outside of those hours.
The method 200 may be practiced where the change in certain conditions includes factors related to network changes. Thus, for example, certain network may be more secure than other networks. Alternatively or additionally, a VPN may be used which will affect container assignments. Alternatively or additionally, decisions may be based on the type of network (such as wireless, cellular, hard-wired), speed of the network, or other considerations. Applications may be placed into containers, based on network considerations and/or changing network considerations, to allow or restrict data access.
The method 200 may be practiced where the change in certain conditions includes factors related to change in device compliance state. For example, a device may have its data encryption, password, or other state changed to a non-compliant state.
The method 200 may be practiced where an application can belong to a plurality of different containers.
Further, the methods may be practiced by a computer system including one or more processors and computer-readable media such as computer memory. In particular, the computer memory may store computer-executable instructions that when executed by one or more processors cause various functions to be performed, such as the acts recited in the embodiments.
Embodiments of the present invention may comprise or utilize a special purpose or general-purpose computer including computer hardware, as discussed in greater detail below. Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system. Computer-readable media that store computer-executable instructions are physical storage media. Computer-readable media that carry computer-executable instructions are transmission media. Thus, by way of example, and not limitation, embodiments of the invention can comprise at least two distinctly different kinds of computer-readable media: physical computer-readable storage media and transmission computer-readable media.
Physical computer-readable storage media includes RAM, ROM, EEPROM, CD-ROM or other optical disk storage (such as CDs, DVDs, etc), magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer.
A "network" is defined as one or more data links that enable the transport of electronic data between computer systems and/or modules and/or other electronic devices. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer properly views the connection as a transmission medium. Transmissions media can include a network and/or data links which can be used to carry or desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Combinations of the above are also included within the scope of computer-readable media.
Further, upon reaching various computer system components, program code means in the form of computer-executable instructions or data structures can be transferred automatically from transmission computer-readable media to physical computer-readable storage media (or vice versa). For example, computer-executable instructions or data structures received over a network or data link can be buffered in RAM within a network interface module (e.g., a "NIC"), and then eventually transferred to computer system RAM and/or to less volatile computer-readable physical storage media at a computer system. Thus, computer-readable physical storage media can be included in computer system components that also (or even primarily) utilize transmission media.
Computer-executable instructions comprise, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. The computer-executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, or even source code. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the described features or acts described above. Rather, the described features and acts are disclosed as example forms of implementing the claims.
Those skilled in the art will appreciate that the invention may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, pagers, routers, switches, and the like. The invention may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks. In a distributed system environment, program modules may be located in both local and remote memory storage devices.
Alternatively, or in addition, the functionality described herein can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include: Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.
The present invention may be embodied in other specific forms without departing from its characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description.

Claims

A computer-implemented method of managing application interaction on a device using containers, the computer-implemented method being performed by one or more processors executing computer executable instructions for the computer-implemented method, and the computer-implemented method comprising:
for a set of applications on a device, based on certain conditions, determining a plurality of container groups, where each container group defines a set of applications and a set of interactions parameters defining boundaries of interactions between the applications for the applications in the container group, wherein applications within a given container are allowed to interact with each other in certain ways as defined by the parameters for the given container;

identifying one or more changes in the certain conditions; and

as a result of identifying one or more changes in the certain conditions changing membership in the container groups, comprising dynamically placing applications in different containers;

wherein the change in certain conditions comprise factors related to one or more of:
installation of an application; removal of an application; change in policy; an application update; an application action; identity switching; geo-fencing; time fencing; network changes; or change in device compliance state and wherein the certain condition comprises factors related to installation source for an application;

wherein the boundaries of interactions between the applications comprise at least one of allowing sharing encryption for a dataset, restricting access to certain data, and restricting certain interactions.
The computer-implemented method of claim 1, wherein an application can belong to a plurality of different containers.
The computer-implemented method of claim 1, wherein the executable instructions are contained on one or more computer-readable media from which the computer-executable instructions are downloaded for execution by the one or more processors.
In a computing environment, a device configured to manage application interaction, the device comprising:
a plurality of applications;

a plurality of application containers, wherein a given application container groups applications together and enforces boundaries of interaction between the applications in the given container based on certain conditions, wherein each container group defines a set of applications and a set of interactions parameters that define the boundaries, and wherein applications within a given container are allowed to interact with each other in certain ways as defined by the parameters for the given container; and

wherein the device is configured to change a set of applications in a container based on changes in conditions, comprising changing membership in the container groups, comprising dynamically placing applications in different containers;

wherein the change in certain conditions comprise factors related to one or more of:
installation of an application; removal of an application; change in policy; an application update; an application action; identity switching; geo-fencing; time fencing; network changes; or change in device compliance state and wherein the certain condition comprises factors related to installation source for an application;

wherein the boundaries of interactions between the applications comprise at least one of allowing sharing encryption for a dataset, restricting access to certain data, and restricting certain interactions.